RE: [PHP] Effects of changing sessid information within URL
| From: | John W. Holmes | Date: | Wed, 16 Apr 2003 11:25:10 +0000 |
| Subject: | RE: [PHP] Effects of changing sessid information within URL | ||
| References: | 1 | Groups: | php.general |
| Request: | Send a blank email to php-general+get-144101@lists.php.net to get a copy of this message | ||
> Will changing the sessid information within the URL have any affect
on
> the REAL session id (initially created when the user logged in)???
No. The file containing the data for the original session will still be
there and will be removed when garbage cleanup comes around. If the
session id is changed in the URL, that now becomes the user's session id
the next time session_start() is called. If a file matching that number
is found, then data from that file is loaded. This would be called
session hijacking. The idea is, though, that the session id is
significantly large enough that by changing it, you're not likely to
come across any other session id that's in use.
---John W. Holmes...
PHP Architect - A monthly magazine for PHP Professionals. Get your copy
today. http://www.phparch.com/